The answer to this question is provided by the European Commission.

Regulation (EU) 2022/2554 (DORA) is applicable to third-country branches in an EU country. With regard to third country branches of undertakings having their head office in third country and that would qualify under Article 2(1)(a) CRD Article 47(1) of Directive 2013/36/EU (Article 48 from 11 January 2027) sets out that branches in a Member State of credit institutions authorised in a third country should not be subject to provisions which result in more favourable treatment than that accorded to branches of credit institutions having their head office in the Union. Additionally, respectively Article 48g(2) and (3) Directive 2013/36/EU, as amended by Article 1(13) of Directive (EU) 2024/1619, set out that class 1 and class 2 third-country branches are subject to Article 74(1) of Directive 2013/36/EU, which explicitly states that institutions shall have robust governance arrangements, which include “network and information systems that are set up and managed in accordance with Regulation (EU) 2022/2554”. 

With regard to branches of insurance and reinsurance undertakings (Article 2(1)(n)) Regulation (EU) 2022/2554 (DORA) is applicable to third-country branches of insurance and reinsurance undertakings as defined in Article 13 of Directive 2009/138/EC (Solvency II). In that respect, Article 162 that sets out conditions for authorising branches within the Union requires that those branches fulfil governance requirements laid down in Chapiter IV, section, including requirements related to ICT governance requirements laid down in Article 41(4) Solvency II which itself refers to DORA. 

By contrast, with regard to insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries (Article 2(1)(o)), in the case where a third country insurance intermediary accesses individual EU Member State(s) market directly (i.e. without recourse to an EU registered insurance intermediary under Article 16, IDD), Directive (EU) 2016/97 (IDD) states (Article 1(6) sub-para. 2) that such intermediary would have to comply with the respective national insurance distribution law of each individual Member State governing access for third country insurance intermediaries. Unless national law explicitly requires it, DORA would therefore not apply.

Disclaimer provided by the European Commission:

The answers clarify provisions already contained in the applicable legislation. They do not extend in any way the rights and obligations deriving from such legislation nor do they introduce any additional requirements for the concerned operators and competent authorities. The answers are merely intended to assist natural or legal persons, including competent authorities and Union institutions and bodies in clarifying the application or implementation of the relevant legal provisions. Only the Court of Justice of the European Union is competent to authoritatively interpret Union law. The views expressed in the internal Commission Decision cannot prejudge the position that the European Commission might take before the Union and national courts.